i have simple test.php page:
<pre><?php system("ls -la /tmp"); ?></pre>
which always shows just: .
and ..
folders and nothing else in browser.
in the command line:
1) ls -la /tmp
2) sudo -u http ls -la /tmp
3) php test.php
4) sudo -u http php test.php
all this commands returns full list of directory files/subdirs.
What is the reason for this???
And problem is "/tmp" folder related because ls -lah /usr
works OK.
i tested this on 4 comps (one of them was debian with php 5.0.6 and there php shows all files OK like i expected, other 3 comps has php7 and shows empty /tmp).
update:
even after adding http to sudoers file and running 'sudo ls /tmp', problem is the same on php versions >7.
but runing 'system("echo aaa > /tmp/aaa.txt; ls -la /tmp") shows .
, ..
, and aaa.txt
file owned by http:http. So is this some new php restriction and how it is posible to interfere on /tmp files only.
update2:
but aaa.txt is not inside /tmp, and by running find /tmp -name aaa.txt
, i see that it is inside /tmp/systemd-private-2cf1853410ad4ade980ec17e883771c3-httpd.service-lZ22gS/tmp/aaa.txt
.
so finaly it is related to something called "systemd /tmp isolation"... that i need to learn about.
Changing true
to false
inside: /etc/systemd/system/multi-user.target.wants/httpd.service
:
[Service]
PrivateTmp=false
...
solves my problem, but i am wondering is it possible to avoid this without changing service file.
exec()
andshell_exec()
sudo
? it's work on my system !stat /tmp
in both cases and edit that into the question too?